chore: remove turbo for now

[bjoerge]

Description

We spent some time today tracking down a build issue that started happening after 4e72b80. However, this build error didn't get reflected as CI build failure, which made it hard to catch. Furthermore, while bisecting to try to pinpoint the offending commit, we found that the way turbo caches the build got in the way and added a lot of confusion to the process.

I'd like to remove turbo entirely for now until we can make sure that CI fails when it should, and only then carefully consider re-adding it if we can get the caching right.

What to review

Do you agree? Is there something obvious I'm missing about how this is supposed to work?

Notes for release

n/a

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
performance-studio	❌ Failed (Inspect)			Mar 12, 2024 9:43pm
test-studio	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Mar 12, 2024 9:43pm

1 Ignored Deployment

Name	Status	Preview	Comments	Updated (UTC)
studio-workshop	⬜️ Ignored (Inspect)	Visit Preview		Mar 12, 2024 9:43pm

[github-actions]

No changes to documentation

[github-actions]

Component Testing Report Updated Mar 12, 2024 8:18 PM (UTC)

File	Status	Duration	Passed	Skipped	Failed
comments/CommentInput.spec.tsx	✅ Passed (Inspect)	32s	15	0	0
formBuilder/ArrayInput.spec.tsx	✅ Passed (Inspect)	6s	3	0	0
formBuilder/inputs/PortableText/Annotations.spec.tsx	✅ Passed (Inspect)	12s	3	0	0
formBuilder/inputs/PortableText/copyPaste/CopyPaste.spec.tsx	✅ Passed (Inspect)	12s	4	2	0
formBuilder/inputs/PortableText/Decorators.spec.tsx	✅ Passed (Inspect)	12s	6	0	0
formBuilder/inputs/PortableText/FocusTracking.spec.tsx	✅ Passed (Inspect)	32s	15	0	0
formBuilder/inputs/PortableText/Input.spec.tsx	✅ Passed (Inspect)	1m 0s	15	0	0
formBuilder/inputs/PortableText/ObjectBlock.spec.tsx	✅ Passed (Inspect)	1m 1s	18	0	0
formBuilder/inputs/PortableText/RangeDecoration.spec.tsx	✅ Passed (Inspect)	12s	6	0	0
formBuilder/inputs/PortableText/Styles.spec.tsx	✅ Passed (Inspect)	13s	6	0	0
formBuilder/inputs/PortableText/Toolbar.spec.tsx	✅ Passed (Inspect)	19s	9	0	0

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/chalk@4.1.2	None	+5	97.4 kB	sindresorhus
npm/chokidar@3.6.0	environment, filesystem	+13	358 kB	paulmillr
npm/dataloader@2.2.2	None	0	62.2 kB	saihaj
npm/debug@3.2.7	environment	+1	60 kB	qix
npm/debug@4.3.4	environment	+3	58.9 kB	qix
npm/esbuild-register@3.5.0	environment, eval, filesystem, unsafe Transitive: network, shell	+5	375 kB	egoist
npm/esbuild@0.19.12	environment, filesystem, network, shell	0	133 kB	evanw
npm/eslint-config-prettier@9.1.0	Transitive: environment, eval, filesystem, shell, unsafe	+82	10.5 MB	lydell
npm/eslint-plugin-react-hooks@4.6.0	environment Transitive: eval, filesystem, shell, unsafe	+82	10.6 MB	gnoff
npm/eslint-plugin-tsdoc@0.2.17	Transitive: eval, filesystem	+11	4.49 MB	odspnpm
npm/eslint@8.57.0	environment, filesystem Transitive: eval, shell, unsafe	+81	10.4 MB	eslintbot
npm/fast-fifo@1.3.2	None	0	5.07 kB	mafintosh
npm/glob@7.2.3	filesystem Transitive: environment	+10	145 kB	isaacs
npm/import-fresh@3.3.0	Transitive: filesystem, unsafe	+3	19.8 kB	sindresorhus
npm/is-builtin-module@3.2.1	Transitive: unsafe	+1	8.39 kB	sindresorhus
npm/js-yaml@4.1.0	Transitive: environment, filesystem	+1	576 kB	vitaly
npm/leven@3.1.0	None	0	5.34 kB	sindresorhus
npm/lodash@4.17.21	None	0	1.41 MB	bnjmnt4n
npm/minimist@1.2.8	None	0	54.5 kB	ljharb
npm/prettier@3.2.5	environment, filesystem, unsafe	0	8.39 MB	prettier-bot
npm/react-dom@18.2.0	environment	+4	4.93 MB	gnoff
npm/react-is@18.2.0	environment	0	24 kB	gnoff
npm/react@18.2.0	environment	+2	337 kB	gnoff
npm/read-pkg-up@7.0.1	Transitive: environment, filesystem	+33	664 kB	sindresorhus
npm/resolve-from@5.0.0	filesystem, unsafe	0	5.82 kB	sindresorhus
npm/rimraf@3.0.2	filesystem Transitive: environment	+11	162 kB	isaacs
npm/split2@4.2.0	None	0	17.4 kB	matteo.collina
npm/use-sync-external-store@1.2.0	environment	+3	375 kB	gnoff
npm/which@2.0.2	environment Transitive: filesystem	+1	20.9 kB	isaacs

🚮 Removed packages: npm/@juggle/resize-observer@3.4.0, npm/@lezer/highlight@1.2.0, npm/@node-ipc/compat@9.2.5, npm/@optimize-lodash/rollup-plugin@4.0.4, npm/@playwright/experimental-ct-react@1.41.2, npm/@playwright/test@1.41.2, npm/@portabletext/react@3.0.11, npm/@portabletext/toolkit@2.0.10, npm/@react-three/cannon@6.6.0, npm/@react-three/drei@9.96.1, npm/@react-three/fiber@8.15.14, npm/@rexxars/gitconfiglocal@3.0.1, npm/@rexxars/react-json-inspector@8.0.1, npm/@rexxars/react-split-pane@0.1.93, npm/@sanity/asset-utils@1.3.0, npm/@sanity/bifur-client@0.3.1, npm/@sanity/color@3.0.0, npm/@sanity/diff-match-patch@3.1.1, npm/@sanity/eslint-config-i18n@1.0.0, npm/@sanity/eslint-config-studio@3.0.1, npm/@sanity/eventsource@5.0.1, npm/@sanity/generate-help-url@3.0.0, npm/@sanity/google-maps-input@3.0.2, npm/@sanity/icons@2.11.2, npm/@sanity/image-url@1.0.2, npm/@sanity/locale-ko-kr@1.0.3, npm/@sanity/locale-nb-no@1.0.3, npm/@sanity/locale-nn-no@1.0.4, npm/@sanity/locale-pt-pt@1.0.2, npm/@sanity/locale-sv-se@1.1.2, npm/@sanity/logos@2.1.6, npm/@sanity/pkg-utils@3.3.8, npm/@sanity/presentation@1.11.4, npm/@sanity/preview-url-secret@1.6.4, npm/@sanity/react-loader@1.9.3, npm/@sanity/telemetry@0.7.7, npm/@sanity/test@0.0.1-alpha.1, npm/@sanity/tsdoc@1.0.0-alpha.44, npm/@sanity/ui-workshop@1.2.11, npm/@sanity/uuid@3.0.2, npm/@sanity/visual-editing@1.7.1, npm/@tanstack/react-virtual@3.0.0-beta.54, npm/@testing-library/jest-dom@6.2.0, npm/@testing-library/react@13.4.0, npm/@testing-library/user-event@13.5.0, npm/@turf/helpers@6.5.0, npm/@turf/points-within-polygon@5.1.5, npm/@types/archiver@6.0.2, npm/@types/arrify@1.0.4, npm/@types/arrify@2.0.1, npm/@types/configstore@5.0.1, npm/@types/connect-history-api-fallback@1.5.4, npm/@types/cpx@1.5.5, npm/@types/decompress@4.2.7, npm/@types/express-ws@3.0.4, npm/@types/express@4.17.21, npm/@types/glob@7.2.0, npm/@types/inquirer@6.5.0, npm/@types/is-hotkey@0.1.10, npm/@types/jsdom@20.0.1, npm/@types/lodash@4.14.202, npm/@types/log-symbols@2.0.0, npm/@types/minimist@1.2.5, npm/@types/moment@2.13.0, npm/@types/node-ipc@9.2.3, npm/@types/node@18.19.8, npm/@types/raf@3.4.3, npm/@types/react-copy-to-clipboard@5.0.7, npm/@types/react-dom@18.2.18, npm/@types/react-is@18.2.4, npm/@types/react@18.2.48, npm/@types/refractor@3.4.0, npm/@types/resolve-from@4.0.0, npm/@types/rimraf@3.0.2, npm/@types/semver-compare@1.0.3, npm/@types/semver@6.2.7, npm/@types/semver@7.5.6, npm/@types/shallow-equals@1.0.3, npm/@types/speakingurl@13.0.6, npm/@types/tar-fs@2.0.4, npm/@types/tar-stream@3.1.3, npm/@types/tar@6.1.10, npm/@types/three@0.150.2, npm/@types/use-sync-external-store@0.0.5, npm/@types/validate-npm-package-name@3.0.3, npm/@types/which@2.0.2, npm/@types/ws@8.5.10, npm/@typescript-eslint/eslint-plugin@6.19.0, npm/@typescript-eslint/parser@6.19.0, npm/@uiw/react-codemirror@4.21.21, npm/@vercel/frameworks@1.6.0, npm/@vercel/fs-detectors@4.1.3, npm/@vercel/stega@0.1.0, npm/@vitejs/plugin-react@4.2.1

View full report↗︎

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source
Install scripts	npm/esbuild@0.18.20	Install script: postinstall Source: node install.js	orphan: npm/esbuild@0.18.20
Install scripts	npm/esbuild@0.19.12	Install script: postinstall Source: node install.js	package.json packages/@sanity/cli/package.json packages/sanity/package.json perf/tests/package.json pnpm-lock.yaml

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore npm/esbuild@0.18.20
• @SocketSecurity ignore npm/esbuild@0.19.12